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Abstract 

In this paper, we consider a scenario where a source node wishes to broadcast two confidential messages for two respective 
receivers, while a wire-tapper also receives the transmitted signal. This model is motivated by wireless communications, where 
individual secure messages are broadcast over open media and can be received by any illegitimate receiver. The secrecy level is 
measured by equivocation rate at the eavesdropper. We first study the general (non-degraded) broadcast channel with confidential 
messages. We present an inner bound on the secrecy capacity region for this model. The inner bound coding scheme is based 
on a combination of random binning and the Gelfand-Pinsker bining. This scheme matches the Marton's inner bound on the 
broadcast channel without confidentiality constraint. We further study the situation where the channels are degraded. For the 
degraded broadcast channel with confidential messages, we present the secrecy capacity region. Our achievable coding scheme 
is based on Cover's superposition scheme and random binning. We refer to this scheme as Secret Superposition Scheme. In this 
scheme, we show that randomization in the first layer increases the secrecy rate of the second layer. This capacity region matches 
the capacity region of the degraded broadcast channel without security constraint. It also matches the secrecy capacity for the 
conventional wire-tap channel. Our converse proof is based on a combination of the converse proof of the conventional degraded 
broadcast channel and Csiszar lemma. Finally, we assume that the channels are Additive White Gaussian Noise (AWGN) and 
show that secret superposition scheme with Gaussian codebook is optimal. The converse proof is based on the generalized entropy 
power inequality. 
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I. Introduction 



t^J- , The notion of information theoretic secrecy in communication systems was first introduced by Shannon in [1]. The information 
J> ' theoretic secrecy requires that the received signal of the eavesdropper does not provide even a single bit information about 
C> the transmitted messages. Shannon considered a pessimistic situation where both the intended receiver and the eavesdropper 
have direct access to the transmitted signal (which is called ciphertext). Under these circumstances, he proved a negative result 
showing that perfect secrecy can be achieved only when the entropy of the secret key is greater than or equal to the entropy 
of the message. In modern cryptography, all practical cryptosystems are based on Shannnon's pessimistic assumption. Due to 
practical constraints, secret keys are much shorter than messages. Therefore, these practical cryptosystems are theoretically 



qq ' susceptible of breaking by attackers. However, the goal of designing such practical ciphers is to guarantee that there exists no 
, efficient algorithm for breaking them. 

Wyner in [2] showed that the above negative result is a consequence of Shannon's restrictive assumption that the adversary 
. i-H , has access to precisely the same information as the legitimate receiver. Wyner considered a scenario in which a wire-tapper 
■ receives the transmitted signal over a degraded channel with respect to the legitimate receiver's channel. He further assumed 
that the wire-tapper has no computational limitations and knows the codebook used by the transmitter. He measured the 
level of ignorance at the eavesdropper by its equivocation and characterized the capacity-equivocation region. Interestingly, a 
non-negative perfect secrecy capacity is always achievable for this scenario. 

The secrecy capacity for the Gaussian wire-tap channel is characterized by Leung-Yan-Cheong in [3], Wyner's work then is 
extended to the general (non-degraded) broadcast channel with confidential messages (BCC) by Csiszar and Korner [4]. They 
considered transmitting confidential information to the legitimate receiver while transmitting common information to both the 
legitimate receiver and the wire-tapper. They established a capacity-equivocation region of this channel. 

The BCC is further studied recently in [5]-[7], where the source node transmits a common message for both receivers, along 
with two additional confidential messages for two respective receivers. The fading BCC is investigated in [8], [9] where the 
broadcast channels from the source node to the legitimate receiver and the eavesdropper is corrupted by multiplicative fading 
gain coefficients, in addition to additive white Gaussian noise terms. The Channel State Information (CSI) is assumed to be 
known at the transmitter. In [10], the perfect secrecy capacity is derived where the channels are slow fading. Moreover, the 
optimal power control policy is obtained for different scenarios regarding availability of CSI. In [11], the wire-tap channel is 
extended to the parallel broadcast channels and the fading channels with multiple receivers. Here, the secrecy constraint is 
a perfect equivocation for each messages, even if all the other messages are revealed to the eavesdropper. The secrecy sum 
capacity for a reverse broadcast channel is derived for this restrictive assumption. The notion of the wire-tap channel is also 
extended to multiple access channels [12]— [15], relay channels [16]— [19], parallel channels [20] and MIMO channels [21]-[26]. 
Some other related works on communication of confidential messages can be found in [27]-[31]. 



Fig. 1. Broadcast Channel with Confidential Messages 



In this paper, we consider a scenario where a source node wishes to broadcast two confidential messages for two respective 
receivers, while a wire-tapper also receives the transmitted signal. This model is motivated by wireless communications, where 
individual secure messages are broadcast over shared media and can be received by any illegitimate receiver. In fact, we simplify 
the restrictive constraint imposed in [11] and assume that the eavesdropper does not have access to the other messages. We 
first study the general broadcast channel with confidential messages. We present an achievable rate region for this channel. 
Our achievable coding scheme is based on the combination of the random binning and the Gelfand-Pinsker bining [32]. This 
scheme matches the Marton's inner bound [33] on the broadcast channel without confidentiality constraint. We further study 
the situation where the channels are physically degraded and characterize the secrecy capacity region. Our achievable coding 
scheme is based on Cover's superposition coding [34] and the random binning. We refer to this scheme as Secret Superposition 
Coding. This capacity region matches the capacity region of the degraded broadcast channel without security constraint. It also 
matches the secrecy capacity of the wire-tap channel. 

The rest of the paper is organized as follows. In section II we introduce the system model. In Section III, we provide an 
inner bound on the secrecy capacity region when the channels are not degraded. In section IV, we specialize our channel to 
the physically degraded and establish the secrecy capacity region. In Section V, we conclude the paper. 



II. Preliminaries 

In this paper, a random variable is denoted by a capital letter (e.g. X) and its realization is denoted by a corresponding lower 
case letter (e.g. x). The finite alphabet of a random variable is denoted by a script letter (e.g. X) and its probability distribution 
is denoted by P(x). Let A" be a finite alphabet set and denote its cardinality by \X\. The members of X n will be written as 
x n = (xi, x 2 , x n ), where subscripted letters denote the components and superscripted letters denote the vector. The notation 
x l ~ 1 denotes the vector (xi,x 2 , ...,Xi-i). A similar notation will be used for random variables and random vectors. 

Consider a Broadcast Channel with Confidential messages as depicted in fig[U In this confidential setting, the transmitter 
(X) wants to broadcast some secret messages to the legitimated receivers (Yi,!^), and prevent the eavesdropper (Z) from 
having any information about the messages. A discrete memoryless broadcast channel with confidential messages is described 
by finite sets X, y\,y 2 ,Z, and a conditional distribution P(yi,y2, z\x). The input of the channel is x e X and the outputs 
are (yi,y2,z) £ (^i x y 2 x Z) for receiver 1, receiver 2, and the eavesdropper, respectively. The transmitter wishes to send 
independent messages (Wi, W2) to the respective receivers in n uses of the channel while insuring perfect secrecy. The channel 
is discrete memoryless in the sense that 

n 

P(y?,y2,z n \x n ) = l[P(y 1 , i ,y2,i,z i \x i ). (1) 

i=l 

A {{2 nRl , 2 nR2 ), n) code for a broadcast channel with confidential messages consists of a stochastic encoder 

/ : ({l,2,...,2" fll } x {1,2,.. .,2"^}) - X n , (2) 

and two decoders, 

fll :^^{l,2,...,2" Rl } (3) 

and 

g 2 :3^{1,2,...,2"^}. (4) 

The average probability of error is defined as the probability that the decoded messages are not equal to the transmitted 
messages; that is, 

pW = P{g x {Y?) g 2 {Y 2 n ) ± W 2 ). (5) 

The knowledge that the eavesdropper gets about W\ and W2 from its received signal Z n is modeled as 

I(Z n ,W 1 ) = H(W 1 )-H(Wi\Z n ), (6) 
I(Z n ,W 2 ) = H(W 2 )-H(W 2 \Z n ), (7) 
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and 

I{Z n 1 (W 1 ,W 2 )) = H(W ll W 2 ) - H(W 1 ,W 2 \Z n ). (8) 

Perfect secrecy revolves around the idea that the eavesdropper cannot get even a single bit information about the transmitted 
messages. Perfect secrecy thus requires that 

I(Z n ,W 1 ) = 0&H(W 1 ) = H(W 1 \Z n ), (9) 
I(Z n , W 2 ) = <s> H{W 2 ) = H(W 2 \Z n ), 

and 

I{Z n ,(W u W2)) = Q&H(W u W2) = H(W 1 ,W 2 \Z n ). (10) 

The secrecy levels of confidential messages W\ and W 2 are measured at the eavesdropper in terms of equivocation rates which 
are defined as follows. 

Definition 1 The equivocation rates R e \, R e2 and R e \ 2 for the Broadcast channel with confidential messages are: 

R el = -H{W 1 \Z n ), (11) 
n 

R e2 = -H(W 2 \Z n ), 

n 

R el2 = -H(W u W 2 \Z n ). 

n 

The perfect secrecy rates Ri and R 2 are the amount of information that can be sent to the legitimate receivers not only reliably 
but also confidentially. 

Definition 2 A secrecy rate pair (R\,R 2 ) is said to be achievable if for any e > 0, there exists a sequence of ( {2 nRl , 2 nIi2 ) , n) 
codes, such that for sufficiently large n, we have: 

Pj")<e, (12) 
R e i>Ri-e!, (13) 
Re2>R 2 -e 2 , (14) 

Rel2>Rl+R2-e 3 - (15) 

In the above definition, the first condition concerns the reliability, while the other conditions guarantee perfect secrecy for each 
individual message and both messages as well. The capacity region is defined as follows. 

Definition 3 The capacity region of the broadcast channel with confidential messages is the closure of the set of all achievable 
rate pairs (Ri,R 2 ). 

III. General BCCs 

In this section, we consider the general broadcast channel with confidential messages and present an achievable rate region. 
Our achievable coding scheme is based on a combination of the random binning and the Gelfand-Pinsker bining schemes [32]. 
The following theorem illustrates the achievable rate region for this channel. 

Theorem 1 Let K/ denote the union of all non-negative rate pairs (Ri,R 2 ) satisfying 

J?i</(^i;Fi)-/(yi;Z), (16) 
R 2 <I(V 2 ;Y 2 )-I(V 2 ;Z), (17) 
R 1 +R 2 <I(V 1 :Y 1 )+ I(V 2 ;Y 2 ) - I(V U V 2 ; Z) - I(V i; V 2 ). (18) 

over all joint distributions P(vi,v 2 )P(x\vi,v 2 )P(yi,y 2 , z\x). Then any rate pair (Ri,R 2 ) G R/ is achievable for the broadcast 
channel with confidential messages. 

Remark 1 If we remove the secrecy constraints by setting Z = 0, then the above rate region reduces to Marton 's achievable 
region for the general broadcast channel. 

Remark 2 If we remove one of the users by setting e.g., y 2 = 0, then we get the Csiszar and Korner's secrecy capacity for 
the other user. 

Proof: 
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Fig. 2. The Stochastic Encoder 



1) Codebook Generation: The structure of the encoder is depicted in Fig|2] Fix P{v\), P{v2) and P(x|wi, v<z). The stochastic 
encoder generates 2 n ( / ( Vi;Yl )~ e ) independent and identically distributed sequences according to the distribution -P(v") = 
n"=i -P^m)- Next, randomly distribute these sequences into 2 nRl bins such that each bin contains 2 n ( I ( Vl > z )- e > codewords. 
Similarly, it generates 2 n ( / ( v ' 2;y2 )~ e ) independent and identically distributed sequences v% according to the distribution P(v 2 ) = 
nr=i -P( u 2,i)- Next, randomly distribute these sequences into 2 nR/2 bins such that each bin contains 2"( / ( V2:Z )~ e ) codewords. 
Index each of the above bins by wi G {1, 2, 2 nRl } and W2 £ {1, 2, 2 nR2 } respectively. 

2) Encoding: To send messages w\ and W2, the transmitter looks for v™ in bin w\ of the first bin set and looks for v 2 in bin 
u>2 of the second bin set, such that (u™ , ) £ ^le"' 1 (iVi .v 2 ) where Ae™'' (Pv 1 . v 2 ) denotes the set of jointly typical sequences u™ 
and v 2 l with respect to P(vi, V2)- The rates are such that there exist more than one joint typical pair, the transmitter randomly 
chooses one of them and then generates x n according to P(x n \v™, v% ) = Y[i=i P{ x i\ v i,i> v 2,i)- This scheme is equivalent to 
the scenario in which each bin is divided into subbins and the transmitter randomly chooses one of the subbins of bin w\ and 
one of the subbins of bin W2- It then looks for a joint typical sequence (t>", v% ) in the corresponding subbins and generates 
x n . 

3) Decoding: The received signals at the legitimate receivers, and y%, are the outputs of the channels P(yi\x n ) = 
n™=i P(Ui-i\ x i) an d P{V2 I 2 -™) = n"=i P{lJ2,i\xi), respectively. The first receiver looks for the unique sequence such that 
i v i>Vi) is jointly typical and declares the index of the bin containing as the message received. The second receiver uses 
the same method to extract the message W2- 

4) Error Probability Analysis: Since the region of ( flZb is a subset of Marton's region then, error probability analysis is the 
same as [33]. 

5) Equivocation Calculation: The proof of secrecy requirement for each individual message ( fT3l and ( fT4b is straightforward 
and may therefore be omitted. 

To prove the requirement of ( fl3l l consider H{W\, W2\Z n ), we have 

H{W u W 2 \Z n ) 
H(W u W 2 ,Z n )- H(Z n ) 

H(W U W 2 , Vin,V 2 n , Z n ) - H(V;\V 2 n \W 1 ,W 2 , Z n ) - H(Z n ) 
H(W U W 2 , Vl\V 2 n ) + H(Z n \W ll W2,V 1 n , V 2 n ) - H{V[\ V 2 n \W ll W 2 , Z n ) - H{Z n ) 

H(W U W 2 , V?, V 2 n ) + H(Z n \W 1 ,W 2 ,V 1 n , V?) - ne n - H(Z n ) 
H(W U W 2 , V?, V 2 n ) + H(Z\Vr, V 2 n ) - ne n - H(Z n ) 
H(V?, V 2 n ) + H{Z n \V?, V 2 n ) - ne n - H(Z n ) 
H(Vn + H(V 2 n ) - I{V?;V 2 n ) - I(V?, V 2 n ; Z n ) - ne n 
I<y?; Y?) + I(V 2 n ; Y?) - I(V; l ;V 2 n ) - I{V?, V 2 n ; Z n ) - ne n 
nRi + ni?2 — ne n , 

where (a) follows from Fano's inequality which states that for sufficiently large n we have H(V™, V 2 n \Wi, W2, Z n ) 
< h(Pwe) +nP™ e I(Vi, V2; Z) < ne n . Here P™ e denotes the wiretapper's error probability of decoding (u",^) in the 



ni? e i2 = 

> 
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> 



(c) 
> 

(J 
(e) 
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case that the bin numbers w\ and w 2 are known to the eavesdropper. Since the sum rate is less than I(Vi,V 2 ; Z), then 
P™ e — > for sufficiently large n. (b) follows from the following Markov chain: (W\, W%) — > (Vi, V2) — > Z. Hence, we have 
H(Z n \W 1 ,W 2 ,V{ l ,V 2 n ) = H{Z n \V?,Vg). (c) follows from the fact that H(W 1 ,W 2 ,V{ l ,V 2 n ) > H{V?,V 2 n ). (d) follows 
from that fact that H (V?) = I{V^\ Y?) and H(V 2 n ) = I{V 2 n ; Y 2 n ). 

■ 

IV. The secrecy capacity Region of the Degraded BCCs 

In this section, we consider the degraded broadcast channel with confidential messages and establish its secrecy capacity 
region. 

Definition 4 A broadcast channel with confidential messages is said to be physically degraded, if X — » Y\ — > Y 2 — > Z forms 
a Markov chain. In the other words, we have 

P(yi,y 2 ,z\x) = P( yi \x)P(y 2 \ yi )P(z\y 2 ). (19) 

Definition 5 A broadcast channel with confidential messages is said to be stochastically degraded if its conditional marginal 
distributions are the same as that of a physically degraded broadcast channel, i.e., if there exist two distributions P (y 2 \yi) 
and P (2 1 J/2) such that 

p(y 2 \x) = j2 p (y^ x ) p '(y^) ( 2 °) 

Vl 

P(z\x) =Y J P{V2\x)P' {z\y 2 ) 

V2 

Lemma 1 The secrecy capacity region of a broadcast channel with confidential messages depends only on the conditional 
marginal distributions P{y\\x), P(y 2 \x) and P{z\x). 

Proof: The proof is very similar to [34] and may therefore be omitted here. ■ 
In the following theorem, we fully characterize the capacity region of the physically degraded broadcast channel with confidential 

messages. 

Theorem 2 The capacity region for transmitting independent secret information over the degraded broadcast channel is the 
convex hull of the closure of all (i? 1; i? 2 ) satisfying 

R 1 <I{X;Y 1 \U)+I(U;Z)-I(X;Z), (21) 
R 2 <I(U;Y 2 )- I(U;Z). (22) 

for some joint distribution P(u)P(x\u)P(yi,y 2 , z\x). 

Remark 3 If we remove the secrecy constraints by setting Z — 0, then the above theorem reduces to the capacity region of 
the degraded broadcast channel. 

Proof: 

Achievability: The coding scheme is based on Cover's superposition coding and the random bining. We refer to this scheme 
as Secure Superposition Coding scheme. The available resources at the encoder are used for two purposes: to confuse the 
eavesdropper so that perfect secrecy can be achieved for both layers, and to transmit the messages in the main channels. To 
satisfy confidentiality, the randomization used in the first layer is again used in the second layer. This makes a shift of I(U; Z) 
in the bound of Rx. The formal proof of the achievability is as follows: 

1) Codebook Generation: The structure of the encoder is depicted in FigO Let us fix P(u) and P(x\u). The stochastic 
encoder generates 2 n ( / ( c/;y2 - l_e * 1 independent and identically distributed sequences u n according to the distribution P(u n ) = 
n™=i P( u i)- Next, we randomly distribute these sequences into 2 ,ii?2 bins such that each bin contains 2™( / (' 7;Z '~ £ ) codewords. 
We index each of the above bins by w 2 £ {1, 2, 2 nB - 2 }. For each codeword of u n , it also generates 2 n ( I ( x ' Yl \ u >~ e ) 
independent and identically distributed sequences x n according to the distribution P{x n \u n ) = IlILi P{ x i\ u i)- We randomly 
distribute these sequences into 2 nRl bins such that each bin contains 2 n ( / ( X;Z ' _/ ( c/ ' Z ) _e ) codewords. We index each of the 
above bins by wi £ {1, 2, 2 nRl }. 

2) Encoding: To send messages wi and w 2 , the transmitter randomly chooses one of the codewords in bin w 2 , say u n . Then 
given u n , the transmitter randomly chooses one of x n in bin w\ of the second layer and sends it. 

3) Decoding: The received signal at the legitimate receivers, j/™ and y%, are the outputs of the channels P(y"\x n ) = 
n"=i P{Vi,i\ x i) an d P{y 2 \ xU ) — YYi=iP{y2,i\ x i), respectively. Receiver 2 determines the unique u n such that (u n ,y 2 ) are 
jointly typical and declares the index of the bin containing u n as the message received. If there is none of such or more than of 



5 



u" • 



Fig 3. Secret Superposition structure 



one such, an error is declared. Receiver 1 looks for the unique (u n ,x n ) such that (u n ,x n ,yi) are jointly typical and declares 
the indexes of the bins containing u n and x n as the messages received. If there is none of such or more than of one such, an 
error is declared. 

4) Error Probability Analysis: Since each rate pair of (I2T1) is in the capacity region of the degraded broadcast channel without 
confidentiality constraint, then it can be readily shown that the error probability is arbitrarily small, c.f. [34]. 

5) Equivocation Calculation: To prove the secrecy requirement of ( fT3l . we have 

nR el = H(Wt\Z n ) 

> H(W!\Z n ,U n ) 

= H(W!,Z n \U n ) - H{Z n \U n ) 

= H{W 1 ,X n ,Z n \U n ) -H{Z n \U n ) -H(X n \Wi,Z n ,U n ) 
= H(W x ,X n \U n ) + H(Z n \Wi,U n ,X n ) - H(Z n \U n ) - ne n 

(b) 

> H(X n \U n ) + H(Z n \X n ) - H(Z n \U n ) - ne n 

= H(X n ; Y?\U n ) + I(U n ; Z n ) - I(X n ; Z n ) - ne n 

> nRi — ne n , 

where (a) follows from Fano's inequality which states that H(X n \Wi, Z n , U n ) < h(Pi n e } ) + nP* e I(X; Z) < ne n for 
sufficiently large n. Here P™ e denotes the wiretapper's error probability of decoding x n given the bin number and the codeword 
u n are known to the eavesdropper. Since the rate is less than I(X: Z), then P" e — * for sufficiently large n. (b) follows 
from the fact that (W\,U) — > X — > Z forms a Markov chain. Thus we have I(Wi,U n ; Z n \X n ) — 0, where it is implied 
that H(Z n \Wi,U n ,X n ) = H(Z n \X n ). (c) follows from two identities: H{X n \U n ) = I{X n ;Y{ l \U n ) and H(Z n \X n ) ~ 
H(Z n \U n ) = I(U n ;Z n ) — I(X n ; Z n ). Since the proof of the requirement (fl4l i is straightforward, we need to prove the 
requirement of (fl31 l. 

nR el2 = H(W 1: W 2 \Z n ) 

> H(W 1 ,W 2 ,Z n ) - H{Z n ) 

= H(W 1 ,W 2 ,U n ,X n ,Z n ) - H(U n ,X n \W u W 2 ,Z n ) - H(Z n ) 
= H(W 1 ,W 2 ,U n ,X n ) 

+ H(Z n \W 1 ,W 2 ,U n ,X n ) - H(U n ,X n \W 1 ,W 2 ,Z n ) - H{Z n ) 

> H(Wi, W 2 , U n , X n ) + H{Z n \W l , W 2 , U n , X n ) - ne„ - H{Z n ) 



(b) 



H{W X , W 2 , U n , X n ) + H{Z\U n , X n ) - ne n - H(Z n ) 



> H{U n ,X n ) + H{Z n \U n , X n ) - ne„ - H(Z n ) 
= H{U n ) + H(X n \U n ) - I(U r \ X n ; Z n ) - ne n 

( =' I(U n ; Y 2 n ) + I(X n : Y"\U n ) - I(X n ; Z n ) - I(U n ; Z n \X n ) - ne n 

> nRi + nR 2 — ne n , 
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where (a) follows from Fano's inequality that H{U n , X n \Wi, W 2 , Z n ) < h(Pi n J) + nP% e I(U, X; Z) < ne n for sufficiently 
large n. Here P" e denotes the wiretapper's error probability of decoding (u n ,x n ) in the case that the bin numbers w\ and 
w 2 are known to the eavesdropper. The eavesdropper first looks for the unique u n in bin w 2 of the first layer, such that it 
is jointly typical with z n . Since the number of candidate codewords is less than I(U; Z), then the probability of error is 
arbitrarily small for a sufficiently large n. Next, given u n , the eavesdropper looks for the unique x n in bin w% which is jointly 
typical with z™. Similarly, since the number of available candidates is less than I(X; Z), then the probability of error decoding 
is arbitrarily small, (b) follows from the fact that (Wi, W2) — > U — > X — > Z forms a Markov chain. Therefore, we have 
I{W U W 2 ; Z n \U", X n ) = 0, where it is implied that H(Z n \W 1 ,W 2 , U n , X n ) = H(Z n \U n , X n ). (c) follows from the fact that 
H(Wi,W 2 ,U n ,X n ) > H(U n ,X n ). (d) follows from that fact that H(U n ) = I(U n ;Y 2 n ) and H(X n \U n ) = I(X n ;Y{ l \U n ). 

Converse: The transmitter sends two independent secret messages W\ and W 2 to receiver 1 and receiver 2 respectively. Let 
us define Ui = {W 2 ,Y[ The following chain of inequality clarifies the proof: 

(a) " 

nRi < ^2l(W 1 ;Y 1 , i \W 2 ,Z i ,Y?- 1 ,Z t+1 )+n6i+ne a 
i=i 



= 1{Wx;Y hi \Ui, Zt, + n5 x + ne 3 



< 5^J(X i ;y M |^ i ,Z i ,Z* 1 - 1 ) + nJi + nc 3 



id) 



(e) 



(/) 



HXi\ Yi,i, U h Zi\Z i+1 ) - I(X t ; Zi\Z i+1 ) - I(X t ; U t \Z t , Z l+1 ) + nS 1 + ne 3 

i=i 

n 

Yi,i\Ui, Z z+1 ) + I(X i; U.,\Z t+1 ) - I(X t ; Zi\Z i+1 ) - I(Xi\ Ui\Zi, Z' +1 ) + nSi + ne 3 

i=i 

n 

J2 1(Xi\ Y u \Ui, Z t+1 ) - I(X t \ Z t \Z t+1 ) + I(Z t \ Ui\Z i+1 ) - I(Zi\ Ui\Xi, Z' +1 ) + n5x + ne 3 

i=l 
n 

Yi,i\U u Z l+1 ) - I(X i; Zi\Z i+1 ) + I(Z i; Ui\Z i+1 ) + nSi + ne 3 



(a) follows from the following lemma 0. (b) follows from the data processing theorem, (c) follows from thej;hain rule, (d) 
follows from the fact that I(X t ; Y" M , Ui, Z t \Z l+1 ) = I(X t ; Ui\Z i+1 )+I(Xi; Y hi \U u Z t+1 ) + /(X i ; Z. t \Y ht , U h and from 

the fact that Z i+1 U l -> X l -> Y lti -> Y 2yi -» Z { forms aJVlarkov chain, which means that I(X i ;Z i \Y 1>i ,Ui,Z i+1 ) = 0. (e) 
follows from the fact that I{X t ; U l \Z l+1 )- I(X, t ; U. t \Z u Z l+1 ) = I(Z t ; U t \Z l+1 ) - I{Z,; U Z \X U Z l+1 ). (/) follows from the 
fact that Z i+1 Ui -> X l -> Z % forms a Markov chain. Thus I(Z t ; U l Z l+1 \X l ) = which implies that I(Z,; U l \X l , Z l+1 ) = 0. 

Lemma 2 : For the broadcast channel with confidential messages of (Wi, W 2 ) — > X n —* Y{ l Y 2 n Z n , the perfect secrecy rates 
are bounded as follows, 

n 

nRx< J2 1(Wi;Y u \W 2 , Z u Yt\Z i+1 ) + n5 1 + ne 3 , (23) 

i=l 
n 

nR 2 <J2HW 2 ; Y 2l I Zt , Yt \Z l+1 ) + n5 1 + ne 2 . (24) 

»=i 

Proof: We need to prove the first bound. The second bound can similarly be proven. According to the above discussion 
nR\ is bounded as follows: 

(a) 

nRi < H{W 1 \W 2 ,Z n )+ne 3 

(ft) 

< H(Wx\W 2 ,Z n ) - H(Wi\Y{ l ,W2)+n6 l + ne 3 
= I(Wi; Y[ l \W 2 )-I{W i; Z n I W 2 ) + n5 x + ne 3 

where (a) follows from the secrecy constraint that H (Wi, W 2 \Z n ) > H(Wi, W 2 ) - ne 3 , the fact that H(W 2 \Z n ) < H(W 2 ) 
and the fact that two messages are independent, (b) follows from Fano's inequality that H (W\ \Y", W 2 ) < n5\. Next, we 
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expand I{Wr,Y?\W 2 ) and I{Wi;Z n \W 2 ) starting with 7(W i; y 1 |W 2 ) and Z n \W 2 ), respectively. 

n 

I{Wv,Y?\W 2 ) = ^HW^Y^Witf- 1 ) 
i=i 

n 

= Yl W , Z t+1 ; Y u | W 2 , Yt 1 ) - I(Z* +1 ; F H | W\,W 2 , Yf 1 ) 
»=i 

n 

= ^ J( Wi ; F H I ^2 , i?" 1 , ) + 7(Z 4+1 ; Y u IW^Yi- 1 )- I(Z i+1 ; Y u \ W\,W 2 , Yt 1 ) 

n 

= ^ J( Wi ; y u I ^ 2 , Yt 1 , ) + Ax - A 2 , 

i=l 

where, Ai = £" =1 1(Z i+1 ; Yii | W2 , Yi* _ 1 ) and A 2 = £" =1 ^ <+1 ; Y u \Wi, W 2 ,Y[~ X )- Similarly, we have, 

n 

i{w t ;Z n \w 2 ) = ^nw^Ziiw^z* 1 ) 

i=l 

n 

= £ /(Wi , Yt 1 ; Z 4 1 W 2 , ) - /( Yt 1 ; | W 1 , Ty 2 , Z i+1 ) 

i=l 

n 

= ^7(VKi;Z,|VF 2 ,y i ^ 1 ,Z 4+1 ) +7(y/" 1 ;Z i |W 2 ,^ i+1 ) - 7(y/- 1 ; | wi , iy 2 , Z t+1 ) 

i=l 

n 

= ^7(^ 1 ;Z^ 2 ,yr 1 ,Z 4+1 ) + At-A*, 

i=l 

where, A* = £™ =1 1 ( Y i~ 1 ^ Zi\W 2 , Z l+1 ) and A* = £™ =1 1 ( Y i~ 1 ^ Z i\ W u W 2 , Z l+1 ). According to lemma 7 of [4], Ai = A* 
and A 2 = AJj. Thus, we have, 

n 

nRi < J^I(W 1 ;Y u \W 2 ,Y;-\Z i+l )-I(W 1 ;Z t \W 2 ,Yt\Z i+1 )+n6 1 +ne 3 

n 

= ]T H(W!\W 2 , Zi, Yt\ Z l+1 ) - H{Wi\W 2 , Y u , Yt\ Z i+1 ) + n6 1 + ne 3 

i=l 
(a) n 

< ^77(VFi|W / 2 ,Z i ,y i i_1 ,Z i+1 ) - H(Wi\W 2 ,Y u ,Zi, Y[~ \Z i+1 ) + nS 1 + ne 3 

i=l 

n 

= ^ 7(vk i; y H |w 2 , Zj, yr 1 , + «Ji + ne 3 , 

i=l 

where (a) follows from the fact that conditioning always decreases the entropy. ■ 
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For the second receiver, we have 



(a) n 

nR 2 < J2l(W 2 ;Y2,i\Yt\Z h Z i+1 )+nS 2 + ne 1 



H(Y 2ti \Yt\ Z h Z l+1 ) - H(Y 2tl \W 2l Y 2 % -\ Z l7 Z +1 ) + nS 2 + ne l 



(6) 



< H(Y 2 ^\Z u Z' l+1 ) - H(Y 2 , l \W 2 ,Yl- 1 ,Y 2 l -\Z l ,Z+ 1 ) + nS 2 + net 



id) 



Y, H(Y 2 ^\Z u Z l+1 ) - H(Y 2 ,i\Ui, Z u Z +1 ) + nS 2 + net 

i=l 
n 

J2 Jpa.iJ Ui\Zi, Z +1 ) + n5 2 + net 

i=l 
n 

J2 I(Y 2ti ; U,\Z +1 ) + I(Y 2ti ;Zi\Ui, Z l+1 ) - /(F 2)i ; + nS 2 + net 

i=l 
n 

J2 I(Y 2 ,n - I(Z i; U t \Z +1 ) + I(Zi; Ui\Y 2<i , Z+ 1 ) + nS 2 + net 

i=l 
n 

J2 I(Y 2ti ; U l \Z+ 1 ) - I(Z i; U l \Z l+1 ) + nS 2 + net, 



where (a) follows from the lemma (fJJ. (b) follows from the fact that conditioning always decreases the entropy, (c) follows 
from the fact that Y 2 l ~ x — > W^Z i+1 Y^~ x —* Y 2i — > Zi forms a Markov chain, (d) follows from the fact that Z l+1 U % — » 
Y Xl -» Z, forms a Markov chain. Thus I{Z l ;U l Z l+1 \Y 2l ) = which implies that I(Zi\ Ui\Y 2U Z i+1 ) = 0. Now, following 
[34], let us define the time sharing random variable Q which is uniformly distributed over {1,2, ...,n} and independent of 

(W u W 2) X»,Yp,Y?). Let us define U = U Q , V = (Z Q+1 ,Q), X = X Q) Y x = Y hQ , Y 2 = Y 2 , Q , Z = Z Q , then we can 
bound Rt and R 2 as follows 

Rt< I(X; Yt\U, V) + I(U; Z\V) - I(X; Z\V), (25) 
R 2 <I(U;Y 2 \V)-I(U:Z\V). (26) 

Since Conditional mutual informations are average of unconditional ones, the maximum region is achieved when V is a 
constant. This proves the converse part. ■ 

V. Gaussian BCCs 

In this section we consider the physically degraded AWGN broadcast channel with confidential messages. We show that secret 
superposition coding with Gaussian codebook is optimal. At time i the received signals are Yti = Xi + nu, Y 2 i = Xi + n 2 i and 
Zi = Xi + n&, where n^'s, n 2 i's and n^i's are each independent identically distributed Gaussian random variables with zero 
means and Var{nji) = Nj, j=l,2,3. All noises are independent of Xi and N x < N 2 < N3. Assume that transmitted power is 
limited to i?[X 2 ] < P. Since the channels are degraded, at time i, Yu = Xi + nti, Y 2 i — Yti + n 2i and Zi = Y 2 i + n 3i , where 
nii's are i.i.d A/"(0, Ni), n 2i 's are i.i.d Af(0, Nt — N 2 ), and n 3i 's are i.i.d Af(0, N 2 — A3). Fig|4]shows the equivalent channels 
for the physically degraded AWGN-BCCs. The following theorem illustrates the secrecy capacity region of AWGN-BCCs. 

Theorem 3 The secrecy capacity region of the AWGN broadcast channel with confidential messages is given by the set of 
rates pairs (Rt,R 2 ) such that 

Rt<c(^-) + c( i l^-)^c(^-), (27) 
« 2 <cKVcKl (28) 



s aP + N 2 J \aP + N 3 
for some a G [0, 1]. 

Proof: 

Achievability: Let U ~ Af(0, (1 - a)P) and X' ~ Af(Q, aP) be independent and X = U + X' ~ Af(0, P). Therefore, 
the amount of I(X;Yt\U), I(U;Z), I(X;Z), and I(U;Y 2 ) can be easily evaluated. Now consider the following secure 
superposition coding scheme: 
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Fig. 4. equivalent channels for the AWGN-BCCs 

1) Codebook Generation: Generate 2 n/ ( c/;Y2 ) i.i.d Gaussian codewords u n with average power (1 — a)P and randomly 
distribute these codewords into 2 nR2 bins. Then index each bin by w 2 G {1, 2, 2 nR2 }. Generate an independent set of 
2ni(x -,Yi^ i.i.d Gaussian codewords x " with average power aP. Then, Randomly distribute them into 2 nRl bins. Index each 
bin by w x £ {1, 2, 2 nfll }. 

2) Encoding: To send messages w\ and w 2 , the transmitter randomly chooses one of the codewords in bin w 2 , (say u 11 ) and 
one of the codewords in bin wi (say x n ). Then, simply transmits x n = u n + x n . 

3) Decoding: The received signal at the legitimate receivers are y\ and y 2 respectively. Receiver 2 determines the unique 
u n such that (m™, j/j ) are jointly typical and declares the index of the bin containing u" as the message received. If there is 
none of such or more than of one such, an error is declared. Receiver 1 uses successive cancelation method; first decodes u n 
and subtracts off an d men looks for the unique x " such that (x ™, y") are jointly typical and declares the indexes of the 
bin containing x " as the message received. 

The error probability analysis and equivocation calculation is straightforward and may therefor be omitted. 
Converse: According to the previous section, R 2 is bounded as follows: 



(29) 



B.2 < I{Y 2 ; U\Z) = H{Y 2 \Z) - H(Y 2 \U, Z) 
The classical entropy power inequality states that: 

2 iH(Y 2 +n' 3 ) > 2 ™ H{Y2) + 2" ff( ™3) 

Therefore, H(Y 2 \Z) can be written as follows: 

H{Y 2 \Z) = H{Z\Y 2 ) + H(Y 2 )-H(Z) 

= - log(7V 3 ~ ^2) + H(Y 2 ) - H(Y 2 + n 3 ) 
< I log(7V 3 - N 2 ) + H(Y 2 ) - I log(2t^) + iV 3 - N 2 ) 
On the other hand, for any fixed a G 1Z, the function 

71 9 

/(t,a)=t-^log(2-*+ a ) 

is concave in t and has a global maximum at t = t max . Thus, H{Y 2 \Z) is maximized when Y 2 (or equivalently X) has 
Gaussian distribution. Hence, 



TL TL TL 

H(Y 2 \Z) < -\og(N 3 -N 2 ) + -\og(P + N 2 )--log(P + N 3 ) 

n f (N 3 - N 2 ){P + N 2 ) 
2 ° g l P + N 3 



(30) 



Now consider the term H(Y 2 \U, Z). This term is lower bounded with H(Y 2 \U, X, Z) = T{\og(N 2 ) which is greater than 
flog(M^M). Hence, 

n N 2 (N 3 -N 2 ) 

flog( 21 ^ 2> ) < H(Y 2 \U,Z) < H(Y 2 \Z) 
Inequalities ( f30l > and QTb imply that there exists a a 6 [0,1] such that 



(31) 



H { Y 2 \U,Z) = n -log(^- N ^ P + N ^ 
K 1 ' ; 2 & I aP + N 3 



(32) 
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Substituting (f32t and (f30b into d29l > yields the desired bound 



R 2 < H(Y 2 \Z)-H(Y 2 \U,Z) (33) 
^ n. ( (P + N 2 )(aP + N 3 ) 



2 b V(-P + N 3 )(aP + N 2 ) 



^aP + N 2 J \aP + N 3 
To bound the rate R\, we need the following generalized entropy power inequality which is proven in [35]. 

Lemma 3 [35]: Let n\, n 2 be two gaussian random variables. Let U be a random variable independent of n\ and n 2 . 
Consider The optimization problem 

max H(X + ni\U)-H(X + n 2 \U) (34) 

P{X\U) 

subject to Var(X\U) < s (35) 

where the maximization is over all distribution of X given U independent of ni and n 2 . A Gaussian P(x\u) with same variance 
for each u is an optimal solution for this optimization problem. 

The rate R\ is bounded as follows 

Ri < I(X;Y 1 \U)-I(X;Z) + I(U;Z) (36) 
= H(Yi\U) - H(Yi\X,U) + H(Z\X) - H(Z\U) 

= H(X + n 1 \U)-H(X + n 3 \U) + -\og(j^-) 

On the other hand using d32l . when Z = and n 2 = then Var(X\U) = aP. Therefore, According to the above lemma the 
Gaussian distribution is optimum and R\ is bounded as 

El < !! log C^±^^1 (37, 



2 °\aP + N 3 Ni 

NiJ \aP + N 3 J \N 3 



VI. Conclusion 

A generalization of the wire-tap channel to the case of two receivers and one eavesdropper is considered. We established an 
inner bound for the general (non-degraded) case. This bound matches Marton's bound on broadcast channels without security 
constraint. Furthermore, we considered the scenario in which the channels are degraded. We established the perfect secrecy 
capacity region for this case. The achievability coding scheme is a secret superposition scheme where randomization in the 
first layer helps the secrecy of the second layer. The converse proof combines the converse proof for the degraded broadcast 
channel without security constraint and the perfect secrecy constraint. We proved that the secret superposition scheme with 
Gaussian codebook is optimal in AWGN-BCCs. The converse proof is based on the generalized entropy power inequality and 
Csiszar lemma. 
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